Cyber incident investigation

The Legal Practice Board (the Board) is continuing to investigate a cyber incident which resulted in some of our systems being taken offline, including our online website services.

We have been working to restore access to systems as soon as possible and have implemented manual workarounds to ensure that we can continue to deliver key services, including processing applications and renewals for Australian practising certificates.

If you have not yet applied for your Australian practising certificate, please download and complete our application form, and return it to us by email on enquiries@lpbwa.com as soon as possible.

If you believe you have submitted your application, but have not received confirmation from us of receipt, please contact the enquiries team on (08) 6211 3600.

Download Australian practising certificate form

Individual practitioners and firm representatives can now access invoices and make payment via the Service Hub. Please note, other services on the Hub remain unavailable - more information on this is provided in the FAQs below.

We are now distributing practising certificates directly to practitioners via email. We are processing these as swiftly as possible.

Ongoing investigation

We are continuing to investigate what has happened as a priority, with support from external experts.

We have confirmed that a small amount of information taken from the Board’s IT environment by an unknown third party was disclosed on 27 May 2025. This information consisted of corporate correspondence containing:

minimal contact information
some operational and resourcing information
banking information for the Board and a very small number of third parties who have been directly notified.

The disclosed data did not include trust information or residential addresses.

Dark web activity

We have been closely monitoring the dark web for any further activity by the third party, who had threatened to disclose more data on 15 June 2025.

On 19 June 2025, the third party published a link to some data, claiming it relates to the Board. We have reviewed this data and can confirm that this data does not relate to the Board.

We are continuing to monitor for any further activity and our investigation into potential data access is ongoing. We have not detected any further activity since 19 June 2025 and will provide further updates as our investigation progresses.

Injunction

To ensure we are taking all available steps in response to this, we have obtained an injunction to prevent any access, dissemination or sharing of data impacted by this incident.

We are also working closely with Cyber Security Western Australia – part of the Office of Digital Government, in the Department of Premier and Cabinet, and other relevant authorities in response to this incident. We will provide further updates as our response progresses.

Further questions

We provide some further FAQs below which our practitioners and broader stakeholders may find helpful. Any questions or concerns about the incident should be directed to incident@lpbwa.com or the helpline on 08 7070 2413.

Previous correspondence to our practitioners

Cyber incident frequently asked questions

I can’t apply for a grant/renewal of my practising certificate

We have implemented manual workarounds to ensure that we can continue to deliver key services, including processing applications for the grant and renewals of Australian practising certificates.

Online applications submitted via the website Service Hub were received by the Board up to 11.29pm, 20 May 2025. If you submitted prior to this time, no further action is required from you with regard to your application.

Any applications submitted after 11.29pm, 20 May 2025 will need to be completed via a manual form. The form can be downloaded here. Please complete this form and then send to enquiries@lpbwa.com.

How can I prove that I’ve submitted my application for a practising certificate?

We have been directly responding to all practitioners who have submitted their application to date, to confirm receipt and that we have the information we need.

If you believe you have submitted your application, but have not received confirmation from us of receipt, please contact the enquiries team on (08) 6211 3600.

If you require proof of your application more urgently for work or employment purposes, please contact the enquiries team on (08) 6211 3600.

When will I get my invoice?

The Legal Practice Board has reinstated online invoices and payments via the Service Hub on our website.

Individual practitioners and firm representatives can now access invoices and make payment via the Service Hub.

Please note, you will be charged the fee that applied on the date your application was submitted, not the date of payment.

Our reconciliation process is ongoing. If you have any concerns about an invoice that requires modification, please contact enquiries@lpbwa.com so our team can help with a resolution.

How do I pay for my practising certificate application?

Individual practitioners and firm representatives can now access invoices and make payment via the Service Hub. Please note, other services on the Hub remain unavailable and applications still need to be downloaded from our website and emailed to the Board.

For practitioners who have requested to be contacted regarding payment or who have not yet completed payment for their practising certificate, we request that you visit the Service Hub to access invoices and complete payment.

For practitioners who have requested that their firm be invoiced for payment, please contact your accounts team and if an invoice is required, this can be downloaded via the Service Hub.

For practitioners who have completed payment, there is no further action required, and we are working to update invoices on the Service Hub.

There’s an issue with my invoice

Our reconciliation process is ongoing. If you have any concerns about an invoice that requires modification, please contact enquiries@lpbwa.com so our team can help with a resolution.

When will I receive my practising certificate?

We are also starting to deliver practising certificates directly to practitioners by email.

This work will be completed in batches. As we have a backlog of applications to process, we ask that you are patient as we work to deliver your practising certificate.

We understand that many practitioners have already completed payment, and we would like to assure you we are working to deliver your practising certificate as soon as possible.

For those yet to complete payment, please complete this via the Service Hub. Your practising certificate will then be processed and issued as soon as possible.

I’ve received two practising certificates – which one should I use?

If you submitted your application online on or after 9 May 2025, and have received a practicing certificate, you may receive an email providing you with a re-issued certificate and new certificate number. This is a result of system restoration works.

If you receive an email with a re-issued practising certificate, please disregard the 2025-26 practising certificate you received earlier in May, and use the new one as your valid Australian practising certificate effective 1 July 2025.

I’m concerned about late fees

We understand that the manual workarounds that have been in place since the recent cyber incident have caused inconvenience for some practitioners, and we apologise for the disruption this has caused.

In light of this, the Board has opted to waive the usual late fees that apply for lodging a renewal application in June. Late fees will resume as usual on Tuesday 1 July 2025.

The Board will log the date we received the application to ensure appropriate payment is invoiced.

If you have any concerns about an invoice that requires modification, please contact enquiries@lpbwa.com so our team can help with a resolution.

Will I be certificated on 1 July 2025?

If you lodged an application with the Board to renew your practising certificate before 30 June 2025, your certificate expiring on 30 June 2025 will remain in force until your renewal application is determined.

We are also working to distribute practising certificates directly to practitioners via email. We are processing these as swiftly as possible.

Is my admissions ceremony going ahead?

Yes, admissions ceremonies are still going ahead – we have implemented manual workarounds to minimise any disruption as much as possible.

If you have an admission ceremony coming up, you can go to the Admissions tab on the website and download the application form and checklist. You can either deliver this information by hand, or email them to enquiries@lpbwa.com. Please make sure that in the subject line, you note which ceremony this is for.

I need to contact/find a practitioner

Our Find a Practitioner search tool is currently unavailable. We are working to restore this as swiftly as possible. In the interim, please contact the Board on (08) 6211 3600 or enquiries@lpbwa.com if you need assistance.

What was the initial date of the incident?

We took some systems offline on Wednesday 21 May following detection of unusual activity on our network. We became aware of disclosure of a small amount of our data on Tuesday 27 May.

What data is involved?

Our investigation to date has found that some limited corporate correspondence was disclosed on Tuesday 27 May.

Our review has found this correspondence did not contain sensitive personal information. The correspondence contained:

minimal contact information;
some operational and resourcing information; and
bank account details for the Board and a very small number of third parties who have been directly notified.

We do not have any credible evidence to confirm at this point of our investigation that the unauthorised third party possesses any other Board data, although we are reviewing what could have been accessed as a priority.

To ensure we are taking all available steps in response to this incident, we have obtained an injunction to prevent any access, dissemination or sharing of data impacted by this incident.

Was more data disclosed on 15 June 2025?

We are aware the third party who disclosed a small amount of data in May threatened to release more data on 15 June 2025. As of 4.30pm on 16 June 2025, the Board had not detected further disclosure of any more data.

On 19 June 2025, the third party published a link to some data, claiming it relates to the Board. We can confirm that this data does not relate to the Board. We have not detected any further activity since this time.

We are continuing to investigate potential information access and, should we find that personal information has been impacted, we will contact affected parties as required.

What does the injunction do?

We have been granted an interim injunction to prevent any access, dissemination or sharing of data impacted by this incident.

Any attempt to access this data may be in contravention of this court order.

Is my residential address impacted?

We have not found any residential addresses in the data disclosed on 27 May. Our investigation is continuing, and we are reviewing what could have been accessed as a priority.

Is my bank/trust account information involved?

If you have not been directly contacted by the Board in relation to your banking information, your banking information was not contained in the disclosed data and there is no action you need to take at this time.

We can also confirm there was no trust information in the disclosed data.

Our investigation is continuing, and we are reviewing what could have been accessed as a priority.

I’m concerned about my bank account information

We would like to assure you that the bank account information in the data disclosed on 27 May related to a very small number of third parties, who have been directly notified.

Additionally, a BSB and account number does not present a direct misuse risk as, alone, they do not allow unauthorised access to your bank account. However, the BSB does identify who the financial institution is, which may make impersonation scam attempts appear more legitimate. This is why it is important that we all practice extra vigilance against the risk of scams.

Should you have any concerns, you can consider the following:

review your transaction history and bank account statements for any suspicious activity;
contact your bank to report this event and flag any suspicious activity identified;
where available use two-step authentication – such as SMS codes to your mobile phone;
check your credit report yearly (this alerts you to any attempts to open a credit account in your name). Information about obtaining a credit report is provided below; and
never respond to, open or click on links in emails purporting to be from your bank (it is always safer to call).

We are continuing to investigate what other information may have been accessed. If you have further queries, please email incident@lpbwa.com or call our helpline on 08 7070 2413.

I can’t view/add CPD Points to the Service Hub

For the time being, CPD providers will not be able to upload CPD activities to the Board's Service Hub. This should not prevent practitioners from completing CPD activities through accredited CPD providers. Once the upload function becomes available, CPD activities can be uploaded and practitioners will be able to view their CPD compliance.

If you have any queries in regard to individual CPD requirements (including exemptions or applications for accreditation), you can refer to the Board’s website, or you can contact us at enquiries@lpbwa.com.

You have been logged out due to inactivity.